import frida
from frida import get_local_device
import sys,fnmatch

def on_message(message,data):
    print(message,data)

def main(target_process,source):
    session=frida.attach(target_process)
    script=session.create_script(source)
    script.on('message',on_message)
    script.load()
    print("[!] Ctrl+D on UNIX, Ctrl+Z on Windows/cmd.exe to detach from instrumented program.\n\n")
    sys.stdin.read()
    session.detach()

def getPid(process_name):
    get_local_device()
    process_name_lc = process_name.lower()
    matching = [process for process in get_local_device().enumerate_processes() if
                fnmatch.fnmatchcase(process.name.lower(), process_name_lc)]
    print(matching)

if __name__=='__main__':
    source='''
        //用户信息
        var ModAddress = Process.findModuleByName('wechatwin.dll');
        console.log('ModAdress:' + ModAddress.base);
        var phoneAddress = ModAddress.base.add('0x1AD1BE0');
        var phone = Memory.readUtf8String(phoneAddress);
        
        var idAddress = ModAddress.base.add('0x1AD1D10');
        var id = Memory.readUtf8String(idAddress);
        
        var nameAddress = ModAddress.base.add('0x1AD1BAC');
        var name = Memory.readUtf8String(nameAddress);
        
        var info={"name":name,"id":id,"phone":phone};
        console.log("info:"+JSON.stringify(info));
        
        //收信息 一注入就崩溃，不知道什么原理
        //wechatwin.dll+0x3E2D0B 函数的入库
        //[edi]+0x40 账号或群号
        //[edi]+0x68 内容
        //[edi]+0x164 群发送账号
        //栈顶的一个参数 就是edi
        
        var msgAddress = ModAddress.base.add('0x3E2D0B');
        Interceptor.attach(msgAddress,
        {
            onEnter:function(args){
                var edi=Memory.readPointer(this.context.edi);
                var wxid=Memory.readUtf16String(Memory.readPointer(edi.add('0x40')));
                var con=Memory.readUtf16String(Memory.readPointer(edi.add('0x68')));
                var wxid2=Memory.readUtf16String(Memory.readPointer(edi.add('0x164')));
                var msg={"wxid":wxid,"con":con,"wxid2":wxid2};
                send("msg:"+JSON.stringify(msg));
            },
            onLeave: function onLeave(retval) {
            }
        }
        );
        
        
        //发信息
    '''
    main(13144,source)
    #getPid('wechat.exe')
    #[Process(pid=13144, name="WeChat.exe", parameters={}), Process(pid=12140, name="WeChat.exe", parameters={})]